Attachment 1 PWS OSBP Support 08212025.pdf

FOR OFFICIAL USE ONLY

DHA PWS Template V9 August 21, 2025

Department of Defense Defense Health Agency

Performance Work Statement

Office of Small Business Program Support Service Contract

Solicitation Number: HT001125RE003

Version 1

Date: August 21, 2025

DHA PWS Template V9 August 21, 2025

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Program Support Services for the Defense Health Agency (DHA) Office of Small Business Programs (OSBP). The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Program Support Services for the OSBP as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property, detailed in Part 3. The contractor shall perform to the standards in this performance work statement.

1.3 Background: The DHA is a Combat Support Agency that supports the delivery of integrated, affordable, and high-quality health services to Military Health System (MHS) beneficiaries and is responsible for driving greater integration of clinical and business processes across the MHS.

The DHA OSBP is responsible for implementing and overseeing statutory and regulatory small business programs. The DHA OSBP advises the DHA Director on all matters related to small businesses and is committed to maximizing the contributions of such businesses in support of DHA’s mission and the acquisition and products to support the mission. The OSBP provides leadership and governance to the DHA Component Acquisition Executive (CAE) and Head of Contracting Activity (HCA) and collaborates with the leadership, program, and technical stakeholders to ensure acquisition strategies result in a positive outcome for small businesses regarding contract requirements. The OSBP ensures that maximum practicable prime and subcontracting opportunities are made available to all small businesses as critical suppliers of required healthcare capabilities and services that meet the needs of the warfighters by creating opportunities for small businesses while ensuring each tax dollar is spent responsibly.

1.4 Objectives: The overall objective of the contract is to provide a full range of operational and management support for the DHA Small Business Program. The Contractor will perform various business, technical, analytical and administrative duties and functions enabling an effectively run, well-supported OSBP office. The Contractor support staff should be high-performing individuals with knowledge in federal procurement, Federal Acquisition Regulations (FAR), Defense Federal Regulations Supplement (DFARS) small business and program execution, strategic communication, mentor-protégé and program support services. The contractor support services are necessary for the effective operation of the DHA OSBP to perform its assigned responsibilities and business program functions in accordance with (IAW) DoDI 4205.01

DHA PWS Template V9 August 21, 2025 and the Small Business Act (15 U.S.C. 644). The contractor will provide support in the following areas:

Program management Technical support Data and Analytical support Administrative services Strategic communication Small Business participation and outreach

1.5 Scope: The Contractor will provide services to assist and support to the DHA Small Business Program to ensure that small businesses are provided maximum practical opportunities in acquisitions as mandated by the Small Business Act. Support will be in the areas of business analysis, program management, and communication.

1.6 Period of Performance (PoP): The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years.

1.6.1 Transition: Transition-in period

1.6.1.1 Transition – in period (Deliverable 1A). The Government defines the transition-in period as the period concurrent with the incumbent’s transition-out period. The Government has scheduled a 30-day transition-in period, beginning on the effective date of the contract in Block 3 of the SF1449. During the transition-in period, the Contractor shall prepare to meet all contract requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date, which is the first day of the period of performance. The transition-in plan shall include, but is not limited to, the following:

Demonstration of a reasonable and realistic approach for assuming full contractual responsibility without disruption or degradation of performance during the transition period

Explanation how the offeror intends to plan for efficient collaboration coordination and communications, and show the offeror’s ability to lower and mitigate risks to minimize disruption of the Office of Small Business Administration programs

Coordination with Government representatives Review, evaluation and transition of current support Transition of historic data as Government Furnished Property Government-approved training and certification process Transfer of all necessary business and/or technical documentation Orientation phase and program to introduce Government personnel, programs, and users to the Contractor’s team, tools, methodologies and business processes Applicable DHA briefings and personnel in-processing procedures, DHA PWS Template V9 August 21, 2025

Coordinate with the Government to account for Government keys, ID access cards and security codes

1.6.1.2 Transition-out period (Deliverable 1B). The Government has scheduled a 30-day Transition-out period. This 30-day period is concurrent to full performance of all PWS tasks. The outgoing contractor will provide the Government with a plan to transition out six months prior to the end of the contract. In accordance with the solicitation, the Contractor shall provide a plan for 30 business days for transitioning work from an active contract to a follow-on contract/order or Government entity. This transition may be to a Government entity, another Contractor, or to the incumbent Contractor under a new contract/order. In accordance with the Government-approved plan, the Contractor shall provide support to the Government in planning and implementing a complete transition from this contract and/or orders issued under this contract to a successful provider. This shall include formal coordination with Government staff and successor staff and management. It also shall include delivery of copies of existing policies and procedures, and delivery of required metrics and statistics. This transition-out plan shall include, but is not limited to:

o Coordination with Government representatives, o Review, evaluation, and transition of current support services, o Transition of historic data to new Contractor, o Government-approved training and certification process, o Transfer of all necessary business and/or technical documentation, o Orientation phase and program to introduce Government personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes, management assistance, o Applicable Tactical Mission Assignment (TMA) debriefing and personnel out-processing procedures, o Turn-in of all government keys, ID/access cards, security codes, and parking passes (if appropriate).

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at the following locations:

1. Defense Health Agency Headquarters, 7700 Arlington Boulevard, Falls Church, Virginia 22042.

2.Telework arrangements for contractor employees may be considered.

1.7.2 Recognized Federal holidays: The contractor is not required to perform services on the following recognized Federal holidays:

DHA PWS Template V9 August 21, 2025

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.3 Hours of operation: Normal core duty hours are 0800 to 1600 Eastern Standard Time, Monday through Friday when government personnel are required to work. The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.7.4 Conduct: Contractor personnel shall adhere to standards of conduct as established by the DHA Director.

1.8 Contractor travel: Contractor will be required to travel within the National Capital Region (NCR) to attend meetings, conferences, and training. The National Capital Region encompasses Washington, DC; Montgomery and Prince George’s Counties in Maryland; Arlington, Fairfax, Loudoun and Prince William counties in Virginia, and the incorporated cities of Alexandria, Falls Church, Fairfax and Manassas in Virginia. The contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of the PWS. Local travel will not be reimbursed. Local Travel is defined as travel within the NCR plus a radius of 50 miles. Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. All travel and transportation shall utilize commercial sources and carriers. The Government shall not pay for business class or first-class travel.

Contractors shall utilize FAR 31.205-46 Travel Costs, for adherence to allowable and allocable travel costs. Except, the Government will not allow any burden rates applied to travel costs. No burdens, indirect rates, or G&A may be charged to travel. Only direct travel costs that the COR has preapproved, and that the COR finds allowable and allocable may be charged to the contract. All travel (other than local travel) requires Government preapproval/authorization and notification to the Contracting Officer Representative (COR). The Government is providing a firm-fixed price not to exceed travel line item. However, actual travel must have been preapproved by the COR and contractor travel must have occurred in order to be billed. All excess funding not used will be deobligated from the travel line item. It is the responsibility of the contractor to manage the travel line item not to exceed amount through the duration of the contract; as no additional funding will be provided.

Annual Travel per Period of performance (Estimate).

DHA PWS Template V9 August 21, 2025

From To Round Trip

#of Trips

#of People

#of Days

Purpose Est.

Cost

Falls Church

Tide Water, VA Y 1 1 2 Outreach Event $ 800.00

Total $ 800.00

1.9 Other Direct Costs (ODC): Not Applicable.

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective quality control plan to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to proactively identify, prevent, and ensure nonrecurrence of defective services. The contractor’s quality control program is the means by which the work complies with stated requirements. The draft QC Plan submitted as part of the technical proposal in response to the solicitation, shall be finalized and submitted within 30 days after contract award. When changes are required to the Quality Control Plan (QCP), they shall be submitted to the CO and COR within 5 working days of a change being made. After acceptance of the QCP the Contractor shall receive the COR’s acceptance in writing of any proposed change to his QC system. See Technical Exhibit 1 - Contract Data Requirements List (Deliverable 2).

1.10.2 Quality assurance: The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP).

This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.10.3. Semiannual assessment – The Contracting Officer (CO), Contracting Officer’s Representative and other Government personnel, as appropriate, shall meet semiannually with the Contractor to review the Contractor’s performance. At these meetings, the COR will apprise the Contractor of how the Government views the Contractor’s performance and the Contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues.

1.10.4 Following each meeting, the Contractor will briefly summarize (no more than 1-2 pages) meeting highlights, any issues identified with plans for corrective action and next steps with copy submitted to the COR three (3) days after the meeting. (Deliverable 3)

1.11 Contractor personnel

1.11.1 Contractor training. The Contractor shall complete all requirements, training, and forms per the DHA’s Onboarding Checklist for Contractor Employees, current edition March 2024 or more recent when updated. Find more details at:

DHA PWS Template V9 August 21, 2025 https://www.health.mil/Reference-Center/DHA-Publications/2024/03/07/DHA-AI-8400- 01T.

1.11.2 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. If performing in a government facility at the close of each work period, Government facilities, equipment, and materials shall be secured.

1.11.3 Key control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO.

1.11.3.1 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying.

When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.11.3.2 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.4 Lock combinations: Not Applicable.

1.12 Key Personnel (Contractor): The Contractor shall provide a Contract/Program Manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated by writing to the Contracting Officer. The Contract/Program Manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The Contract/Program Manager or alternate shall be available Monday thru Friday, 8:00 a.m. to 4:30 p.m., except Federal Holidays or when the Government facility is closed for administrative reasons. Qualifications for key personnel are listed below:

1.12.1 Contract/Program Manager and Alternate. The Contract/Program Manager and Alternate must have a minimum of a bachelor’s degree in a business field and at least five

DHA PWS Template V9 August 21, 2025

(5) years’ experience successfully managing several direct reports and multiple functional areas.

1.12.2 Contract/Program Manager and Alternate who either the (i) the Contractor proposed pre-award or alternatively (ii) are replacement Key Personnel pursuant to the Contracting Officer’s written and signed authorization shall not be replaced for a period of one (1) year after award or after replacement. The only exceptions to this are:

1. Serious, prolonged illness, the onset of which post-dates the Contractor’s submission of that Key person’s resume to the Government.

2. Death or dismemberment

In any of these events, the Contractor shall promptly notify the Contracting Officer Representative (COR) and provide the information required by the CO. After the initial one (1) year period, all proposed substitutions must be submitted in writing, at least 15 days (30 days if a security clearance is to be obtained) in advance of the proposed substitutions to the CO.

1.13 Data Rights: Not Applicable.

1.14 Reporting

1.14.1 Contract Manpower Reporting (CMR): Not Applicable.

1.14.2 Non-Disclosure Agreement (NDA): All DHA Government Contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. The Contractor shall maintain originally signed NDAs of individual employees and provide copy of each to the COR. (Deliverable 4).

1.14.3 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property;

DHA PWS Template V9 August 21, 2025 and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the Contractor's performance. At these meetings the CO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.14.5 Progress Report: The Contractor shall ensure that a Monthly Progress Reports (MPR) is submitted to the COR outlining the expenditures, progress, status, and any problems/issues encountered in the performance of this contract. (Deliverable 5)

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an the government furnished Common Access Card (CAC). All Contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Assistant Director-Support (AD-S)/Component Acquisition Executive (CAE), and Head of the Contracting Activity (HCA) has business dealings. The contractor shall identify themselves as a support contractor personnel in all telephone conversations, email correspondence and face-to-face meetings.

1.15.2 Security and Common Access Card (CAC) requirements: The Contractor shall follow the DHA CAC request process, current version 2.1, January 2018, or more recent when updated. See process attached in Section Part 7.1 of the PWS. A CAC is the standard identification for eligible DoD Contractor personnel.

1.15.3 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their Contractor status known during introductions.

1.15.4 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in all written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to DHA Network(s)

1.16.1 The Contractor’s Facilities Security Officer (FSO)/ Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The Contractor shall be prepared for this process as it could take two (2) or more weeks. The Facilities Security Officer/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Contractor’s FSO/Security POC must notify the Personnel Security Officer when the Contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a Contractor’s termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The Contractor shall comply with the latest version of “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs,”; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),”. Contractor responsibilities for ensuring personnel security include, but are not limited to meeting the following requirements:

1.17.1.1. Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at 703-681-6777. The main number for DHA Headquarters is 1-888-647-6676.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Office will deny any access to any automated information system (AIS), network, or CUI a Contractor receives an unfavorable adjudication or if information that would result in an unfavorable adjudication becomes available.

DHA PWS Template V9 August 21, 2025

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Managements) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a Contracting Officer’s Technical Representative (COTR), designated and authorized in writing by the contracting officer to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government will prepare the quality assurance surveillance plan in accordance with Part 7 herein.

2.2 Acronyms:

ADP/IT Automated Data Processing/Information Technology AIS Automated Information System AO Authorizing Official AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate CAC Common Access Card CAP Cloud Access Point CDI Covered Defense Information CDRL Contract Data Requirement List CE Computing Environment CIO Chief Information Officer

DHA PWS Template V9 August 21, 2025

CJCSM Chairman of the Joint Chiefs of Staff Manual CMR Contractor Manpower Reporting CND SP Computer Network Defense Service Provider CNSSI Committee on National Security Systems Information CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CS Contract Specialist CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD 254 Department of Defense Contract Security Requirement List (if applicable) DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information Systems Agency DoD Department of Defense DoDI Department of Defense Instruction DoDM Department of Defense Manual EULA End User License Agreements.

FAR Federal Acquisition Regulation FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Management Act FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity HIT Health Information Technology IA Information Assurance IAVM Information Assurance Vulnerability Management I/O In/Out Processing Portal IS Information System IT Information Technology ISCM Information Security Continuous Monitoring iRAPT Invoicing, Receipt, Acceptance, and Property Transfer (formerly

Wide Area Work Flow) NCR National Capital Region NDA Non-Disclosure Agreement NIST National Institute of Standards and Technology OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs P&R Personnel and Readiness P-ATO Provisional Authorization to Operate

DHA PWS Template V9 August 21, 2025

PA Provisional Authorization PHI Protected Health Information PII Personally Identifiable Information PK Public Key PKI Public Key Infrastructure PMO Program Management Office POC Point of Contact PoP Period of Performance PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RMF Risk Management Framework SAR Security Assessment Report SP Special Publication SRG Security Requirements Guide(s) STIG Security Technical Implementation Guide(s) TE Technical Exhibit TOS Terms of Service US United States XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.: Not Applicable.

DHA PWS Template V9 August 21, 2025

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.1. Services: Not Applicable.

3.2 Facilities: The Government will make available a limited amount of space for personnel working onsite, in accordance with tasks outlined in this PWS.

3.3 Utilities: The Government will provide all utilities in the government facility for the Contractor’s use in performance of tasks outlined in this PWS.

3.4 Equipment: The Government will provide ancillary equipment such as scanners, fax machines and laptops with accessories at Government onsite work location. Common Access Cards will also be provided. Contractor will be responsible for any supplies and equipment needed that are not provided by the Government.

3.5 Materials: The Government will provide Standard Operating Procedures and Policies.

DHA PWS Template V9 August 21, 2025

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 General: The Contractor shall furnish all supplies, materials, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.2 Secret Facility Clearance: Not Applicable.

4.3 Materials: Not Applicable.

4.4 Equipment: Not Applicable.

4.5 Facilities: Not Applicable.

DHA PWS Template V9 August 21, 2025

PART 5

5.0 SPECIFIC TASKS

5.1 Basic Services: The Contractor shall be responsible for providing subject matter expert technical and small business programs support to assist the OSBP in developing, staffing, managing and accomplishing the functional and support services:

5.2 Business Execution Support

5.2.1 Industrial and Data Analysis and Program Performance. The Contractor shall support and provide assistance to OSBP to become a more data-driven organization to make decisions that bring value to support the DHA mission. The contractor shall support and provide assistance through the use of analytical tools and real-time visibility of performance metrics to facilitate in-depth analysis of what is driving the DHA small business performance. The Contractor shall also provide assistance and support in the evaluation of strategic planning initiatives and establishment of annual small business goals.

5.2.1.1 Program Execution – The Contractor shall support OSBP in the daily monitoring and distribution of communication from a variety of sources such as received via OSBP electronic mailboxes, public media, and internal and/or external Government sources and compile a listing of salient facts derived from such monitoring. Provide weekly small business achievement report of program execution. (Deliverable 6) Monitor and disseminate industry related news items that are of interest to small business stakeholders or program managers. Provide semi-annual report of subcontracting achievements.

(Deliverable 7)

5.3 Strategic Communication Support

5.3.1 Outreach – The Contractor shall assist with planning, organizing, conducting, and assessing specific outreach events annually to develop relevant, predictive and periodic requirements. The Contractor shall support the benefit assessment and provide monthly written recommendations for OSBP participation in new non-DoD external events.

(Deliverable 8) Develop metrics to support evaluation of value of outreach and provide a semi-annual report of events attended. (Deliverable 9) Prepare and assemble authorization documentation for OSBP engagements for approval by senior leadership.

5.3.1.1 The Contractor shall support OSBP in industry outreach, coordinating all of its speaking engagements, and outreach events. The Contractor shall manage all information on the OSBP internet website. Management of the OSBP website includes information management systems, site maintenance and the update of all data and website links.

5.3.1.2 Communication – The Contractor shall support existing electronic communications media hosted on DHA networks and servers, including web presence, visual displays and social media engagement. Coordinate and assist in the development of draft communications pertaining to small business matters and conduct monthly communication with Small Business Programs participants. Assist in the development and production of written communication such as the annual Small Business Executive Summary, Newsletters, training and marketing materials. Recommend public interface sources, monitor, coordinate and post relevant communications to social media networks such as Twitter, Facebook and Blogs to provide information to the public Support the

DHA PWS Template V9 August 21, 2025 development of dynamic web content for the purpose of disseminating information to small business stakeholders

5.6 Mentor-Protégé Program (MPP) Support Services

5.6.1 Mentor Protégé Execution Support

5.6.1.1 MPP Analysis Support – The Contractor shall perform support functions, such as needs assessment, drafting content, coordinating review of documents in support of the issuance and implementation. Content for policies may include external and internal sources such as legislative, Federal and Defense Acquisition Regulations, directives, instructions, or guidance.

5.7 Mentor Protégé Management

5.7.1 Contractor shall provide Program Management Oversight with coordination and review of new agreements and program management reviews with all stakeholders and assist with the development and management of budget and expenditure reports.

5.8 Staffing Plan and Staffing Levels (Deliverable 10) – At contract award, the Contractor’s final proposed and Government approved staffing levels showing each CLIN, labor category, and respective labor categories will be reviewed for compliance.

After contract award, the contractor shall provide an updated status report of the staffing plan on the 30th of each month. At a minimum, the staffing plan status report shall specify the following information: What positions were originally proposed at offering, the name of the person working in that position, if there are any upcoming or anticipated changes to that position/or change of employee working in that position, how many positions are staff and not staffed, the reason for not staffing of each position, how long each position has been vacant and details to include why each position is vacant and a detailed plan explaining how the contractor plans to fill the vacancy.

5.8.1 Staffing Levels – The contractor shall be required to maintain the staffing levels (labor categories and associated hours) in the Staffing Plan as incorporated into the contract award. The Contractor shall fill any vacant position within 30 days of the vacancy. A status update is required within 10 days, outlining recruitment efforts, and interim coverage. A final update confirming the new hire and start date is due within 30 days.

DHA PWS Template V9 August 21, 2025

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is Controlled Unclassified Information.

6.2 The Automated Data Processing/Information Technology (ADP/IT) levels and position sensitivity designation for positions under this contract are:

6.2.1. ADP/IT II: Non-critical sensitive position.

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: Contractors shall adhere to requirements regarding PII in DoDI 5400.11, DoD Privacy and Civil Liberties Programs if applicable, and DHA Administrative Instruction-110, Safeguarding Procurement Sensitive Information.

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the Contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The Contractor submits the DSAA even if a Subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the Contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements:

6.4.1.1 Training: All Contractor and associated Subcontractor employees working Cybersecurity Information Assurance (IA)/Cyberspace functions must comply with DoD training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M. Contractors shall identify, document, track, and report qualifications of contract support personnel who perform cyberspace work roles.

DHA PWS Template V9 August 21, 2025

6.4.1.2 Certification: The Contractor shall ensure that personnel accessing IS have the proper and current IA certification to perform IA functions at contract award in accordance with DoD 8570.01–M, IA Workforce Improvement Program. The Contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239- 2001, including:

6.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

6.4.1.2.2 Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

6.4.1.2.2.1 Upon request by the Government, the Contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

6.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD IS for the purpose of performing IA functions.

6.4.2 User requirements: All Contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: Not Applicable.

6.6 Risk Management Framework (RMF) for DoD IT: Not Applicable.

6.7. Facility Related Control Systems: Not Applicable.

6.8. System Communications: Not Applicable.

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-to-Business (B2B) Gateway: Not Applicable.

6.10 Contractor Provided IT Infrastructure: Not Applicable.

6.11 System Authorization Access Request (SAAR), Defense Department (DD) Form

6.11.1 The Contractor shall submit the most current version of DD Form 2875, “System Authorization Access Request (SAAR), in accordance with CO guidance for all Contractors that use the DoD Gateways to access Government IT systems and/or DoD applications shall. A DD Form 2875 shall be completed for each Contractor employee who will access any system and/or application on a DoD network. The DD Form 2875

DHA PWS Template V9 August 21, 2025 shall clearly specify the system and/or application name and justification for access to that system and/or application.

6.11.2 The Contractor shall submit the completed DD Form 2875 to the DHA IT Security for verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that the Contractor employee has the appropriate background investigation completed or a request for background investigation has been submitted to the Office of Personal Management (OPM). Acknowledgment from OPM that the request for a background investigation has been received and that an investigation has been scheduled will be verified by the DHA Personnel Security prior to access being approved.

6.11.3 Upon approval, DHA will notify the user of the ID and password via secure/encrypted e-mail upon the establishment of a user account. User accounts will be established for individual use and may not be shared by multiple users or for system generated access to any DoD application. Misuse of user accounts by individuals or Contractor entities will result in termination of system access for the individual user account.

6.11.4 The Contractor shall conduct a monthly review of all Contractor employees who have been granted access to DoD IS’/networks to verify that continued access is required.

6.11.5 The Contractor shall provide the DHA DPCLO with a report of the findings of their review by the 10th day of each month following the review. Reports identifying changes to Contractor employee access requirements shall include the name, DoD ID number from CAC, Company, IS/network for which access is no longer required and the date access will be terminated.

6.12 MHS Systems Telecommunications

6.12.1 The primary communication links shall be via encrypted tunnels (i.e., Secure Internet Protocol (IPSEC), GetVPN, or Secure Socket Layer) between the Contractor’s primary site and the MHS B2B Gateway.

6.12.2 The Contractor shall place the VPN appliance device outside the Contractor’s firewalls and shall allow full management access to this device (e.g., in router access control lists) to allow Central VPN Management services provided by DHA or other source of service as designated by the MHS to remotely manage, configure, and support this VPN device as part of the MHS VPN domain.

6.12.3 The Contractor shall procure and configure for operation an auxiliary VPN device for backup purposes to minimize any downtime associated with problems of the primary

VPN.

DHA PWS Template V9 August 21, 2025

6.12.4 The Contractor shall send devices to the MHS VPN management authority (e.g., DHA) via postage paid and include prepaid return shipping arrangements for the devices(s).

6.12.5 The MHS VPN management authority (e.g., DHA) will remotely configure and manage the VPN appliance once installed by the Contractor.

6.12.6 The Contractor shall be responsible for the maintenance and repair of Contractor procured VPN equipment.

6.12.7 The Government will be responsible for the troubleshooting of VPN equipment.

6.13 Establishment of Telecommunications

6.13.1 Telecommunications shall be established with the MHS through coordination with DHA.

6.13.2 The Contractor and DHA Program Office shall identify their requirement(s) for the establishment of telecommunications with the MHS and/or other Government entities.

6.13.3 The DHA/MedCOI B2B Gateway Questionnaire (provided by DHA) identifies the required telecommunication infrastructure between the Contractor and the MHS systems. This includes all Wide Area Network, Local Area Network, VPN, Web DMZ, and B2B Gateway access requirements.

6.13.4 The Contractor shall complete their applicable portion of the questionnaire and shall return it to the DHA designated POC for review and approval.

6.13.5 The Contractor shall, Upon Government request, provide technical experts to provide any clarification of information provided in the questionnaire. DHA will review and process the questionnaire when it is accepted.

6.13.6 DHA will coordinate any requirements for additional information with the POC and schedule any meetings required to review the Questionnaire. Upon approval of the Questionnaire, DHA will coordinate a testing meeting with appropriate stakeholders.

6.13.7 DHA will notify the Contractor POC of the meeting schedule. The purpose of the testing meeting is to complete a final review of the telecommunication requirements and establish testing dates.

6.14 Contractors Located On Military Installations

6.14.1 The Contractor(s) shall coordinate/obtain the connections with the local MTFs/ Enhanced Multi-Service Markets (eMSMs) and Base/Post/Camp communication

DHA PWS Template V9 August 21, 2025 personnel located on a military installation who require direct access to Government systems.

6.14.2 These connections will be furnished by the Government.

6.14.3 Contractors located on military installations that require direct connections to their networks shall provide an isolated IT infrastructure. They shall coordinate with the Base/Post/Camp communications personnel and the MTF/eMSM in order to get approval for a Contractor procured circuit prior to installation to ensure the Contractor is within compliance with the respective organizational security policies, guidance and protocols.

Note: In some cases, the Contractor may not be allowed to establish these connections due to local administrative/security requirements.

6.14.4 The Contractor shall be responsible for all security certification documentation as required to support DoD IA requirements for network interconnections.

6.14.5 The Contractor shall provide, on request, detailed network configuration diagrams to support IA accreditation requirements.

6.14.6 The Contractor shall comply with IA accreditation requirements. All network traffic shall be via Transmission Control Protocol/Internet Protocol using ports and protocols in accordance with current Service security policy. All traffic that traverses MHS and/or military Service Base/Post/Camp security infrastructure is subject to monitoring by security staff using Intrusion Detection Systems.

DHA PWS Template V9 August 21, 2025

PART 7, ATTACHMENT 1

PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective

Standard Performance Threshold

Method of Surveillance

PRS #1

The Contractor shall provide Non- Disclosure Forms PWS paragraph 1.14.2

Submitted morning of first day of period of performance

100% COR- Initial inspection of documentation

PRS #2

The Contractor shall provide Monthly Progress Report (MPR) PWS paragraph 1.14.5

Deliver Monthly Report no later than two days of due date

Completed on time 95% of the time; must be 95% accurate

COR will assess based on PWS

PRS #3

The Contractor shall develop and maintain and provide Quality Control (QC) CDRL A001

Provides required data, meets quality assessment, meets delivery schedule as per the agreed upon delivery schedule no later than 1 week from the due date.

No more than two requests by the COR for revision, completeness and/or corrections Must be met 90% of the time during the quarter.

Comparison of Deliverable with PWS requirements and comparison of actual date that deliverable is completed to the planned date(s)

PRS #4

The Contractor shall provide Emergency Plan PWS paragraph 1.7.4

Provides required data, meets quality assessment, meets delivery schedule as per the agreed upon delivery schedule

Completed on time 90% of the time; must be 90% accurate

Comparison of Deliverable with PWS requirements and comparison of actual date that deliverable is completed to the planned date(s)

DHA PWS Template V9 August 21, 2025

Performance Objective

Standard Performance Threshold

Method of Surveillance

PRS #5

The Contractor shall provide Small Business Analysis Support PWS paragraph 5.2.1.1

Provides required data, meets quality assessment, meets delivery schedule as per the agreed upon delivery schedule

Provides materials, requests, reports, data and any requirement in accordance with the PWS as agreed upon Must be met 90% of the time during the quarter.

Comparison of Deliverable with PWS requirements and comparison of actual date that deliverable is completed to the agreed upon or planned date(s)

PRS #6

The Contractor shall provide SB Outreach Support

PWS paragraph 5.3.1

Provides required data, meets quality assessment, meets delivery schedule as per the agreed upon delivery schedule

Provides materials, requests, reports, data and any requirement in accordance with the PWS as agreed upon Must be met 90% of the time during the quarter.

Comparison of Deliverable with PWS requirements and comparison of actual date that deliverable is completed to the agreed upon or planned date(s)

PRS #7

The Contractor shall provide Small Business Reports PWS paragraph 5.2.1.2

Provides required data, meets quality assessment, meets delivery schedule

Completed on time 90% of the time; must be 90% accurate

COR inspection of documentation and evaluation of data for completeness and accuracy

PRS #8

The Contractor shall provide Draft slides and presentations PWS paragraph 5.2.1

Provides required data, meets quality assessment, meets delivery schedule

Completed on time 90% of the time; must be 90% accurate

COR inspection of documentation and evaluation of data for completeness and accuracy

PRS #9

The Contractor shall provide Schedule…